WSO2 WSO2 Carbon Identity Application Authentication Framework

• CVE-2024-4412 Low 2.7 Expression Language Injection via User Input in Multiple WSO2 Products Permits Arbitrary Operations 0.4%
• CVE-2025-5802 Medium 5.3 Username Enumeration via Self Registration Flow in Multiple WSO2 Products Allows User Account Discovery 0.3%
• CVE-2025-15039 Critical 9.4 Account Takeover via Conditional Authentication Script Logic in Multiple WSO2 Products 0.7%
• CVE-2025-13909 Medium 4.3 Information Disclosure via Multi-Tenant Authentication Flows in WSO2 Identity Server Allows Cross-Tenant PII Exposure 0.3%
• CVE-2023-6837 High 8.5 Incorrect Authorization in Multiple WSO2 Products via Federated Authentication with JIT Provisioning Leading to User Impersonation 0.5%